ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Display Filter Reference: SEBEK - Kernel Data Capture

Protocol field name: sebek

Versions: 1.0.0 to 4.2.5

Back to Display Filter Reference

Field name Description Type Versions
sebek.cmdCommand NameCharacter string1.0.0 to 4.2.5
sebek.counterCounterUnsigned integer (32 bits)1.0.0 to 4.2.5
sebek.dataDataCharacter string1.0.0 to 4.2.5
sebek.fdFile DescriptorUnsigned integer (32 bits)1.0.0 to 4.2.5
sebek.inodeInode IDUnsigned integer (32 bits)1.0.0 to 4.2.5
sebek.lenData LengthUnsigned integer (32 bits)1.0.0 to 4.2.5
sebek.magicMagicUnsigned integer (32 bits)1.0.0 to 4.2.5
sebek.pidProcess IDUnsigned integer (32 bits)1.0.0 to 4.2.5
sebek.ppidParent Process IDUnsigned integer (32 bits)1.0.0 to 4.2.5
sebek.socket.callSocket.Call_idUnsigned integer (16 bits)1.0.0 to 4.2.5
sebek.socket.dst_ipSocket.remote_ipIPv4 address1.0.0 to 4.2.5
sebek.socket.dst_portSocket.remote_portUnsigned integer (16 bits)1.0.0 to 4.2.5
sebek.socket.ip_protoSocket.ip_protoUnsigned integer (8 bits)1.0.0 to 4.2.5
sebek.socket.src_ipSocket.local_ipIPv4 address1.0.0 to 4.2.5
sebek.socket.src_portSocket.local_portUnsigned integer (16 bits)1.0.0 to 4.2.5
sebek.time.secTimeDate and time1.0.0 to 4.2.5
sebek.typeTypeUnsigned integer (16 bits)1.0.0 to 4.2.5
sebek.uidUser IDUnsigned integer (32 bits)1.0.0 to 4.2.5
sebek.versionVersionUnsigned integer (16 bits)1.0.0 to 4.2.5